vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: update PrivRequest table to match actual hive-sh4re::priv_proto variants

Browse source 
Replace stale AddBindMount/RemoveBindMount/SetNetworkIsolation/ReloadGateway
entries with the actual current variants from hive-sh4re/src/priv_proto.rs:

- WriteNspawnFlags (replaces AddBindMount/RemoveBindMount/SetNetworkIsolation)
- WriteResourceLimits (new)
- RemoveServiceDropin (new)
- DaemonReload (new)
- ChownSocketDir / ChmodSocketDir (new)
- RunForgeAdmin (new)
- RestartMatrixDaemon (new)
- ReloadGatewayNginx (renamed from ReloadGateway)
This commit is contained in:
iris 2026-06-05 18:36:39 +02:00 • committed by mara
commit 09e2ad326c
1 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/security.md
View file

@ -98,10 +98,15 @@ known operations; there is no arbitrary command pass-through:
| `DestroyContainer` | `nixos-container destroy <name>` | | `DestroyContainer` | `nixos-container destroy <name>` |
| `ListContainers` | `nixos-container list` | | `ListContainers` | `nixos-container list` |
| `ReadContainerJournal` | `journalctl -M <container> -n <n> [filters...]` | | `ReadContainerJournal` | `journalctl -M <container> -n <n> [filters...]` |
| `ReloadGateway` | `systemctl -M hive-gateway reload/start/reset-failed nginx` | | `ReloadGatewayNginx` | `systemctl -M hive-gateway reload/start/reset-failed nginx` |
| `AddBindMount` / `RemoveBindMount` | `systemctl set-property` or `machinectl bind` | | `WriteNspawnFlags` | write `/etc/nixos-containers/<container>.conf` (bind-mount list + network isolation vars) |
| `WriteAgentForgeToken` / `WriteAgentMatrixToken` | write `0600` credential file into agent state | | `WriteResourceLimits` | write `CPUQuota=`/`MemoryMax=` systemd drop-in for agent container |
| `SetNetworkIsolation` | manage per-container network isolation flags | | `RemoveServiceDropin` | remove `container@<name>.service.d/` drop-in on destroy |
| `DaemonReload` | `systemctl daemon-reload` |
| `ChownSocketDir` / `ChmodSocketDir` | chown/chmod `/run/hive-agent/<name>/` socket directory |
| `RunForgeAdmin` | `nixos-container run hive-forge -- runuser -u forgejo -- forgejo admin <args>` |
| `WriteAgentForgeToken` / `WriteAgentMatrixToken` | write `0600` credential file into agent state dir |
| `RestartMatrixDaemon` | `systemctl --machine=h-<name> restart hive-matrix-daemon.service` |
**Container allowlist** — every request is validated against an **Container allowlist** — every request is validated against an
allowlist before any operation: only names matching `h-<agent>` (the allowlist before any operation: only names matching `h-<agent>` (the